News for hackers. Stuff that matters.

A comment on Sequoia PGP 1.0 Released: The Seedling Is a Sapling. Parent comment

Re:Sequoia PGP 1.0 Released: The Seedling Is a Sapling by dfabulich on Wednesday December 16, 2020 @08:12PM (#25451099)
In practice, Debian downloads your packages over HTTPS from reliable trusted parties. HTTPS is the real, actual defense against package manipulation. The PGP signatures do nothing, but they don't really need to work; that's why nobody's bothered to fix them.
[ Parent | on HN ]
Re:Sequoia PGP 1.0 Released: The Seedling Is a Sapling by anderskaseorg on Wednesday December 16, 2020 @08:31PM (#25451221)
No, a default Debian installation downloads packages over plain HTTP. It doesn’t even support downloading packages over HTTPS unless you install the optional apt-transport-https package and edit your sources.list.

It uses SHA-2 checksums since Debian 9, though.

[ Parent | on HN ]
Re:Sequoia PGP 1.0 Released: The Seedling Is a Sapling by pabs3 on Wednesday December 16, 2020 @09:26PM (#25451634)
https cannot protect you from malicious apt mirrors or CDN node operators.
[ Parent | on HN ]